In our increasingly digital world, financial losses through fraud and scams have become all too common. The latest report from the National Anti-Scam Centre found more than $2.18 billion was lost to scams in 2025, up almost 8 per cent on the previous year.
No sector is safe, including super.
The Australian Securities and Investments Commission has previously written to superannuation trustees, warning of the need to strengthen anti-scam practices or risk exposing members to harm.
Despite this, SMSF trustees continue to fall victim to fraud, whether through compromised bank accounts, investment scams, fraud via a trusted person or similar.
For trustees, such an event is understandably distressing and the priority is often quickly contacting the relevant authorities in an attempt to recoup some of the financial loss.
However, beyond that there’s another largely invisible aspect to SMSF fraud: what process should the auditor follow when that loss appears in the fund’s financial statements?
The role of the auditor
The unexplained disappearance of funds from an SMSF can raise serious audit concerns.
The auditor’s role in these situations is to independently examine all available evidence to determine whether a breach of the Superannuation Industry (Supervision) (SIS) Act or Regulations has occurred.
However, what happens if the auditor determines the trustee hasn’t breached the regulations, despite funds going missing?
In the recent example of the First Guardian Master Fund, trustees lost significant amounts from their SMSFs amid allegations of fraudulent conduct that was no fault of their own.
Another example may be a trustee scammed into providing the passwords for a crypto account, resulting in significant financial loss, again through no fault of their own.
Evidence is key
The key here is supporting documentation.
An auditor should never simply accept an assertion of fraud without obtaining sufficient evidence supporting the claim.
This is vital, as often in the case of a scam or fraud, the trustee may believe the absence of funds alone is enough to prove what has taken place.
However, they should be able to provide details of the original investment or transaction, bank statements, relevant correspondence between parties (including the scammer), reports to authorities, legal advice or other evidence.
It is only through the independent examination of such information that an auditor can be satisfied the funds have been lost through no fault of the trustee.
The question then becomes whether evidence of the fraud should remain only in the auditor’s working papers or whether the ATO should be formally notified in the form of an auditor contravention report (ACR).
It is true the idea of a contravention report can trigger concern among trustees. Despite this, my preference is to lodge a report, but it is important there is an understanding as to why.
Understanding the ACR
An ACR does not constitute an allegation of wrongdoing or financial impropriety, but is simply an evidence-based statement of fact, along with any corrective actions required or already undertaken, where possible.
Trustees should also be aware section 130A of the SIS Act allows an auditor to use an ACR to provide information that does not have to be reported as a contravention, but would benefit the ATO in its regulatory role.
In the event of fraud, the lodgement of an ACR is not a notification a breach has taken place, but rather that something significant has occurred, the available evidence has been independently looked at and the auditor believes the regulator should have that information.
Trustee v auditor – who should report?
In the event of SMSF fraud resulting in the loss of monies, it is likely the trustee will report the matter to the relevant authorities, including ScamWatch, the police and the ATO.
Is an auditor lodging an ACR doubling up by telling the ATO information it may already be aware of? In short, no.
The role of an auditor is to act as an independent, objective set of eyes, examining all available evidence.
If, after bank statements, financials and other relevant documents have been examined, the auditor is satisfied the fund has been the victim of fraud, it is best practice for the ATO to also have the benefit of that independent information.
In many ways the ACR strengthens the trustee’s assertion fraud has taken place.
It’s important to note the auditing standards also require the auditor to take certain steps when fraud or suspected fraud is identified, including a report to the appropriate authority, in this case, the ATO.
ACR in every instance?
Trustees need not fear that every minor event or disputed transaction will be formalised in an ACR.
Auditors will continue to apply professional judgment and decide whether there is benefit for the regulator in passing on information learned through the audit.
However, in the case of fraud, an ACR can be a useful tool. It not only advises the ATO the SMSF has suffered a material loss, but that trustees have advised fraud has occurred, it has been reported to the relevant authorities and the auditor has reviewed evidence supporting those circumstances.
Losing retirement savings to fraud is serious and given the total value of the superannuation sector in Australia continues to increase, it is likely a financially attractive target for scammers.
We have seen the federal government proposing further anti-scam measures in the form of unique identification for SMSF bank accounts, but without further detail it remains to be seen whether this will have a real impact on reducing fraud in this space.
New measures or not, it won’t change the important, but often invisible, role auditors play in situations involving fraud and how an ACR can act as a safeguard for trustees at a time they need it most.